VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents (arXiv 2607.09653)

Summary

VEXAIoT is an autonomous multi-agent framework that uses large language model (LLM) reasoning combined with offensive security tools to discover and exploit vulnerabilities in IoT systems. IoT devices are inherently vulnerable due to hardware constraints, outdated firmware, and insecure configurations. The framework combines a vulnerability detection agent with an attack execution agent that performs reconnaissance, plans attack sequences, and executes exploits. The authors—Katherine Swinea, Kshitiz Aryal, Lopamudra Praharaj, and Maanak Gupta—evaluated the system in IoTGoat and Metasploitable environments across ten attack scenarios mapped to OWASP IoT vulnerabilities. Out of 260 attack executions, VEXAIoT achieved an overall success rate of 95.0% (94.5% on IoTGoat, 96.7% on Metasploitable2), with most attacks completing in under two minutes on average. The paper, available as arXiv:2607.09653, was released on 2026-07-10 and falls within the Security/AI research area.